Sec + Flash Cards
Chapter 1: Social Engineering Techniques
While waiting in the lobby of your building for a guest, you notice a man in a red shirt standing close to a locked door with a large box in his hands. He waits for someone else to come along and open the locked door and then proceeds to follow her inside. What type of social engineering attack have you just witnessed?
A. Impersonation
B. Phishing
C. Boxing
D. Tailgating
D. Tailgating
Chapter 1: Social Engineering Techniques
A colleague asks you for advice on why he can’t log in to his Gmail account. Looking at his browser, you see has typed www.gmal.com in the address bar. The screen looks very similar to the Gmail login screen. Your colleague has just fallen victim to what type of attack?
A. Jamming
B. Rainbow Table
C. Whale Phishing
D. Typosquatting
D. Typosquatting
Chapter 1: Social Engineering Techniques
A user in your organization contacts you to see if there’s any update to the “account compromise” that happened last week. When you ask him to explain what he means, and the user tells you he received a phone call earlier in the week from your department and was asked to verify his user ID and password. The user says he gave the caller his user ID and password. This user has fallen victim what specific type of attack?
A. Spear Phishing
B. Vishing
C. Phishing
D. Replication
B. Vishing
Attacker used the social engineering attack that uses voice communication.
Chapter 1: Social Engineering Techniques
Coming into your office, you overhear a conversation between two security guards. One guard is telling the other she caught several people digging through the trash behind the building early this morning. The security guard says the people claimed to be looking for aluminum cans, but only had a bag of papers - with no cans. What type of attack has this security guard witnessed?
A. Spear Phishing
B. Pharming
C. Dumpster Diving
D. Rolling Refuse
C. Dumpster Diving
Chapter 1: Social Engineering Techniques
Which of the following are specifically used to spread influence, alter perceptions, and sway people toward a position favored by those spreading it?
A. Identity fraud, invoice scams, credential harvesting
B. Hoaxes, eliciting information, urgency
C. Influence campaigns, social media, hybrid warfare
D. Authority, intimidation, consensus
C. Influence campaigns, social media, hybrid warfare
Chapter 1: Social Engineering Techniques
Which type of the following is a type of social engineering attack in which an attacker attempt to obtain sensitive information from a user by masquerading as a trusted entity in an email?
A. Phishing
B. Pharming
C. Spam
D. Vishing
A. Phishing
Key element in a phishing attack are the use of emails.
Chapter 1: Social Engineering Techniques
Which of the following is/are psychological tools used by social engineers to create a false trust with a target?
A. Impersonation
B. Urgency or scarcity
C. Authority
D. All of the above
D. All of the above
Chapter 1: Social Engineering Techniques
Once an organization’s security policies have been established, what is the single most effective method of countering potential social engineering attacks?
A. An active security awareness program
B. A separate physical access control mechanism for each department in the organization
C. Frequent testing of both the organization’s physical security procedures and employee telephone practices.
D. Implementing access control cards and the wearing of security identification badges.
A. An active security awareness program.
People are the weakest link, to an organization when dealing with a cyber attack.
Chapter 1: Social Engineering Techniques
You notice a new custodian in the office, working much earlier than normal, emptying trash cans, and moving slowly past people working. You ask him where the normal guy is, and in very broken English he says, “Out sick”, indicating a cough. What is happening?
A. Watering hole attack
B. Impersonation
C. Prepending
D. Identity fraud
B. Impersonation
The new custodian working much earlier, moving slow past workstations, he was being very “suspicious”
Chapter 1: Social Engineering Techniques
Your boss thanks you for pictures you sent from the recent company picnic. You ask him what he is talking about, and he says he got an e-mail from you with pictures from the picnic. Knowing you have not sent him that e-mail, what type of attack do you suspect is happening?
A. Phishing
B. Spear Phishing
C. Reconnaissance
D. Impersonation
B. Spear Phishing
This was a targeted attack against a specific person.
Chapter 2: Type of Attack Indicatiors
A disgruntled administrator is fired for the negligence at your organization. Thirty days later, your organization’s internal file server and backup server crash at exactly the same time. Examining the servers, you determine that critical operating system files were deleted from both systems. If the disgruntled administrator was responsible for administering those servers during her employment, this is most likely an example of what kind of malware?
A. Crypto-malware
B. Trojan
C. Worm
D. Logic Bomb
D. Logic Bomb
Chapter 2: Type of Attack Indicators
A colleague has been urging you to download a new animated screensaver he has been using for several weeks. While he is showing you the program, the cursor on his screen moves on its own and a command prompt window opens and quickly closes. You can’t tell what if anything was displayed in that command prompt window. your colleague says, “it’s been doing that for a while, but it’s no big deal.” Based on what you’ve seen, you suspect the animated screensaver is really what type of malware?
A. A worm
B. A trojan
C. Ransomware
D. Spyware
B. A trojan
Chapter 2: Type of Attack Indicators
Several desktops in your organization are displaying a red screen with the message “Your files have been encrypted. Pay 1 bitcoin to recover them.” These desktops have most likely been affected by what type of malware?
A. Spyware
B. Spraying
C. Ransomware
D. Crypto-malware
C. Ransomware
Chapter 2: Type of Attack Indicators
While port-scanning your network for unauthorized systems, you notice one of your file servers has TCP port 31337 open. When you connect to the port with the security tool netcat, you see a prompt that reads, “Enter password for access.” Your server may be infected with what type of malware?
A. PUP
B. Fileless Virus
C. Backdoor
D. Man In The Middle Attack (MITM)
C. Backdoor
Chapter 2: Type of Attack Indicators
While port scanning your network for unauthorized systems, you noticed one of you file servers has TCP port 61337 open. When you use Wireshark and examine the packets, you see encrypted traffic, in single packets, going back and forth every five minutes. The external connection is a server outside of your organization. What is this connection?
A. Command and control
B. Backdoor
C. External backup location
D. Remote Login
A. Command and control
Periodic traffic that looks looks like a heartbeat on high ports to an unknown server outside the network is suspicious, and this is what many command and control signals look like.
Chapter 2: Type of Attack Indicators
A user in your organization is having issues with her laptop. Every time she opens a web browser, she see different pop up ads every few minutes. It doesn’t seem to matter which websites are being listed – the pop ups still appear. What type of attack does this sound like?
A. A potentially unwanted program (PUP)
B. Ransomware
C. Worm
D. Virus
A. A potentially unwanted program (PUP)
The web browser was bundle with other applications and is performing tasks that are undesired.
Chapter 2: Type of Attack Indicators
User at your organization are complaining about slow systems. Examining several of them, you see that CPU utilization is extremely high and a process called “btmine” is running on each of the affected systems. You also notice each of the affected systems is communicating with an IP address outside your country on UDP port 43232. If you disconnect the network connections on the affected systems, the CPU utilization drops significantly. Based on what you’ve observed, you suspect these systems are infected with what type of malware?
A. Rainbow tables
B. Crypto-malware
C. Dictionary
D. Hybrid
B. Crypto-malware
Chapter 2: Type of Attack Indicators
A piece of malware is infecting the desktops in your organization. Every hour, more systems are infected. The infections are happening in a different departments and in cases where the users don’t share any files, programs, or even emails. What type of malware can cause this type of infection?
A. Virus
B. Trojan
C. RAT
D. Worm
D. Worm
The malware is moving across the network
Chapter 2: Type of Attack Indicators
Which of the following are characteristics of remote access trojans?
A. They can be deployed through malware such as worms.
B. They allow attacks to connect to the system remotely.
C. They give attackers the ability to modify files and change settings.
D. All of the above
D. All of the above
Chapter 2: Type of Attack Indicators
To test your systems against weak passwords, you as an admin ( with proper permissions) test all the accounts using Top 100 commonly used passwords. What is this test an example of?
A. Dictionary
B. Password spraying
C. Rainbow tables
D. Online
B. Password spraying
Using preset passwords against all accounts is an example of password spraying
Keyword: systems ( meaning multiple computers, servers)
Chapter 3: Application Attack Indicators
When an attacker captures network traffic and retransmits it at a later time, what type of attack are they attempting?
A. Denial of service attack
B. Replay attack
C. Bluejacking attack
D. Man in the middle attack
B. Replay attack
Chapter 3: Application Attack Indicators
What type of attack involves an attacker putting a layer of code between an original device driver and the operating system?
A. Refactoring
B. Trojan horse
C. Shimming
D. Pass the hash
C. Shimming
Chapter 3: Application Attack Indicators
You’re reviewing a custom web application and accidentally type a number in a text field. The application returns an error message containing variable names, filenames, and the full path of the application. This is an example of which of the following?
A. Resource exhaustion
B. Improper error handling
C. Generic error message
D. Common misconfiguration
B. Improper error handling
Chapter 3: Application Attack Indicators
You’re working with a group testing a new application. You’ve noticed that when three or more of you click Submit on a specific form at the same time, the application crashes every time. This is most likely an example of which of the following”
A. A race condition
B. A nondeterministic error
C. An undocumented feature
D. A DLL injection
A. A race condition
Chapter 3: Application Attack Indicators
An externally facing web server in your organization keeps crashing. Looking at the server after a reboot, you notice CPU usage is pegged and memory usage is rapidly climbing. The traffic logs show a massive amount of incoming HTTP and HTTPS requests to the server. Which type of attack is this web server experiencing?
A. Input validation
B. Distributed error handling
C. Resource exhaustion
D. Race condition
C. Resource exhaustion
Chapter 3: Application Attack Indicators
Your organization is considering using a new ticket identifier with your current help desk system. The new identifier would be a 16-digit integer created by combining the date, time and operator ID. Unfortunately, when you’ve tried using the new identifier in the “ticket number” field on your current system, the application crashes every time. The old method of using a five-digit integer works just fine. This is most likely an example of which of the following?
A. Common misconfiguration
B. Zero-day vulnerability
C. Memory leak
D. Integer overflow
D. Integer overflow
Chapter 3: Application Attack Indicators
While examining a laptop infected with malware, you notice the malware loads on startup and also loads a file called net utilities.dll each time Microsoft Word is opened. This is an example of which of the following?
A. Race condition
B. DLL injection
C. System infection
D. Memory overflow
B. DLL injection
Chapter 3: Application Attack Indicators
A web application you reviewing has an input field for username and indicates the username should be between 6 and 12 characters. You’ve discovered that if you input a username that’s 150 characters or more in length, the application crashes. What is this an example of?
A. Memory leak
B. Buffer overflow
C. Directory traversal
D. Integer overflow
B. Buffer overflow
Chapter 3: Application Attack Indicators
Your organization is having issues with a custom web application. The application seems to run fine for a while but starts to lock up or crash after seven to ten days. of continuous use. Examining the server, you notice that memory usage seems to climb every day until the server runs out of memory. The application is most likely suffering from which of the following?
A. Memory leak
B. Overflow leak
C. Zero-day exploit
D. Pointer dereference
A. Memory leak
Chapter 3: Application Attack Indicators
Your database server is returning a large dataset to an online user, saturating the network. The normal return of records would be a couple at most. This is an example of what form of attack?
A. Memory leak
B. LDAP injection
C. Man in the middle
D. SQL injection
D. SQL injection
Chapter 4: Network Attack Indicators
A user reports “odd certificate warnings on her web browser this morning whenever she visits Google. Looking at her browser, you see these certificate warning. Looking at the network traffic, you notice that all HTTP and HTTPS request from that system are being routed to the same IP regardless of destination. Which of the following attack types are you seeing in this case?
A. Evil twin
B. Man in the middle
C. Disassociation
D. MAC cloning
B. Man in the middle
Chapter 4: Network Attack Indicators
User are reporting that the wireless network on one side of the building is broken. They can connect but can’t seem to get to the internet. While investigating, you notice all of the affected users connecting to an access point you don’t recognize. These users have fallen victim to what type of attack?
A. Rogue AP
B. WPS
C. Bluejacking
D. Disassociation
A. Rogue AP
Chapter 4: Network Attack Indicators
You’re sitting at the airport when your friend gets a message on her phone. In the text is a picture of a duck with the word “Pwnd” as the caption. Your friend doesn’t know who sent the message. Your friend is a victim of what type of attack?
A. Snarfing
B. Bluejacking
C. Quacking
D. Collision
B. Bluejacking
Chapter 4: Network Attack Indicators
All of the wireless users on the third floor of your building are reporting issues with the network. Every 15 minutes, their devices disconnect from the network. Within a minute or so they are able to reconnect. What type of attack is most likely underway in this situation?
A. Evil twin
B. Jamming
C. Domain hijacking
D. Disassociation
D. Disassociation
Chapter 4: Network Attack Indicators
Your e-commerce site is crashing under an extremely high traffic volume. Looking at the traffic logs, you see tens of thousands of requests for the same URL coming from hundreds of different IP addresses around the world. What type of attack are you facing?
A. Domain hijacking
B. DDoS
C. DNS poisoning
D. URL redirection
B. DDoS
Chapter 4: Network Attack Indicators
A user wants to know if the network is down because she is unable to connect to anything. While troubleshooting, you notice the MAC address for her default gateway setting doesn’t match the MAC address of your organization’s router. What type of attack has been used against this user?
A. MAC cloning
B. ARP poisoning
C. Disassociation
D. Rogue access point
B. ARP poisoning
Chapter 4: Network Attack Indicators
You have a help desk ticket for a system that is acting strangely. Looking at the system remotely, you see the following in the browser cache: www.micros0ft.com/office. What type of attack are you seeing?
A. Powershell
B. Domain hijacking
C. URL redirection
D. Disassociation
C. URL redirection
Chapter 4: Network Attack Indicators
You are seeing a bunch of PDFs flood people’s inboxes with titles such as “New Tax Rates for 2021.” What attack vector is most likely in use?
A. Python
B. Macro
C. Man in the middle
D. DDoS
B. Macro
Chapter 4: Network Attack Indicators
When you update your browser, you get a warning about a plugin not being compatible with the new version. You do not recognize the plugin, and you aren’t sure what it does. Why is it important to understand plugins? What attack vector can be involved in plugins?
A. Man in the middle attack
B. Domain hijacking attack
C. Man in the browser attack
D. URL redirection attack
C. Man in the browser attack
Chapter 4: Network Attack Indicators
Your network scan is showing a large number of address changes to the MAC tables and lots of ARP and RARP messages. What is happening?
A. MAC flooding attack
B. Disassociation attack
C. Jamming attack
D. DNS poisoning
A. MAC flooring attack
an attempt to overflow the MAC tables in the switches
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
Your senior financial people have been attacked with a piece of malware targeting financial records. Based on talking to one of the executives, you now know this is a spear fishing attack. Which of the following is the most likely vector used?
A. Cloud
B. Wireless
C. Direct access
D. Removable media
D. Removable media
Removeable media commonly linked to social engineering attacks such as spear phishing.
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
You are new to your job, new to the industry, and new to the city. Which of the following sources would be the best to connect with your peers on threat intelligence information?
A. Vendors
B. Social media
C. Local industry groups
D. Vulnerability or threat feeds
C. Local industry groups
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
Your company has had bad press concerning its support (or lack of support) for a local social issue. Which type of hacker would be the most likely threat to attack or deface your website with respect to the issue?
A. State actor
B. Hacktivist
C. Black hat
D. Competitor
B. Hacktivist
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
Proper use of separation of duties with respect to privileged user on your systems is a defense against which of hacker?
A. Nation-state actor
B. Insider
C. Criminal syndicate
D. All of the above
D. All of the above
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
You have read about a new threat against software that is vulnerable to hacking. The vulnerability is in a Python library, and your firm uses Python for the development of many in-house projects. Where is the best source of information with respect to this threat?
A. File/code repositories
B. Vulnerability
C. Open source intelligence
D. Indicators of compromise
A. File/code repositories
The code you are concerned about was developed in-house. hence it will not show up in commercial databases or other sources
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
You use a “golden disk” to provision new machines from your vendors. As part of the incident response, you have discovered that the source of the malware you are seeing comes from this golden disk. This is an example of what vector?
A. Insider
B. Removable media
C. Direct access
D. Supply chain
D. Supply chain
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
Your threat intelligence vendor is sending out urgent messages concerning a new form of memory resident malware. What is the likely item they are sharing with you?
A. Vulnerability database
B. Indicator of compromise
C. Dark web
D. Trusted Automated Exchange of Intelligence Information (TAXII)
B. Indicator of compromise
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
Understanding how an attacker operates so that you can develop a defensive posture is done through the use of which of the following?
A. Predictive analysis
B. TTPs
C. Threat maps
D. Automated Indicator Sharing
B. TTPs
Adversary tactics, techniques, and procedures (TTPs) provide details on how an adversary operates.
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
Which of the following items do you as a defender have control over with respect to using threat intelligence to defend your systems?
A. Vectors
B. Actors
C. Threat intelligence sources
D. Attributes of actors
A. Vectors
Chapter 5: Threat Actors, Vectors, and Intelligence Sources
You want to get specific information on a specific threat that you have read about in you online newsfeed on your phone. Which of the following is the best source for detailed information?
A. Vulnerability database
B. Open source intelligence
C. Dark web
D. Predictive analysis
B. Open source
Chapter 6: Vulnerabilities
Direct third-party risks include which of the following? (Choose all that apply)
A. System integration
B. Supply chain
C. Financial management
D. Vendor management
A. System integration
B. Supply chain
D. Vendor management
Point to look at:
C. Financial management is related to impacts, not mainly third part risks.
